0

I have windows 2008 vps used for webhosting. The main compnay website sits at https://www.fakehostingcompany.com and uses a ssl certificate from rapidSSl. All has been working fine so far.

A few clients have bought ssl certificates for there domains, lets say, sitea.com and siteb.com using the normal csr route to obtain a certificate.

When adding the new certificates to the sites and adding the https bindings, all other ssl are invalid.

if i view the certificate information in the browser it will show fakehostingcompany.com and sitea.com's certificate name points to siteb.com's ssl certificate and is invalid.

Basically the last certificate I bind into iis overwrites the other certificate information.

So if i had to add sitea.com's certificate last, fakehostingcompany.com and siteb.com would be invalid.

I've been struggling for the past few days now trying to get this right, and i hope someone can help me on this or point me in the right direction.

Improve this question
  • Can you upgrade to IIS8? You could use SNI then. Else you will need to assign a separate IP for each site/cert binding. – jscott Dec 22 '16 at 17:05
  • You have a couple of options, you will need to use a combination of internal and external IPs (messy) or setup something like nginx.com to act as a proxy for the other server – Drifter104 Dec 22 '16 at 17:13
2

Historically a given IP address could support exactly one SSL certificate. This is because the point in the communication where the HTTP 'Host' header is provided is after the entire SSL handshake has occurred.

A SSL/TLS extension called 'SNI' allows a server to select which SSL certificate to present based on the client request, however this was introduced into IIS in 8: https://www.iis.net/learn/get-started/whats-new-in-iis-8/iis-80-server-name-indication-sni-ssl-scalability

For IIS7 you'll need to get a single certificate that has Subject Alternative Names for all the clients you support, and update this certificate as new clients come on: https://en.wikipedia.org/wiki/Subject_Alternative_Name

Improve this answer
  • so each site on the server cannot have there own ssl certificate ? – Bradley Dec 22 '16 at 17:11
  • @Bradley With a single IP and lacking SNI, yes -- one cert only. You can have one 'cert' that is valid for all of the different domain names, but as a provider you'll have to procure that cert as your clients won't be allowed to create certs for other clients. – Jason Martin Dec 22 '16 at 17:14
  • Historically a given IP address could support exactly one SSL certificate -- it is incorrect. Single IP always supported multiple SSL certificates. IP/Port combination is where only single SSL cert binding was allowed. – Crypt32 Dec 22 '16 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.